The only reason Docker will ever try to pull from Hub is if you don’t preface the image name with your repository tag. You could blacklist Hub in your AWS settings / a proxy if you really want to disallow pulling from Hub.